VulnerabilityModified
CVE-2021-1801
Maliciously crafted web content may violate iframe sandboxing policy.
MEDIUM 6.5EPSS 1.52%
Does this matter?
Lower severity and a low EPSS score (1.52%). Track it; it rarely justifies an emergency change on its own.
Description
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 1.52% probability · 73th percentile
- CISA KEV
- Not listed
- Affected
- apple/ipad os · apple/iphone os · apple/macos · apple/tvos · apple/watchos · fedoraproject/fedora · webkitgtk/webkitgtk
- Source
- product-security@apple.com
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/
- https://security.gentoo.org/glsa/202104-03Third Party Advisory
- https://support.apple.com/en-us/HT212146Vendor Advisory
- https://support.apple.com/en-us/HT212147Vendor Advisory
- https://support.apple.com/en-us/HT212148Vendor Advisory
- https://support.apple.com/en-us/HT212149Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/
- https://security.gentoo.org/glsa/202104-03Third Party Advisory
- https://support.apple.com/en-us/HT212146Vendor Advisory
- https://support.apple.com/en-us/HT212147Vendor Advisory
- https://support.apple.com/en-us/HT212148Vendor Advisory
- https://support.apple.com/en-us/HT212149Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.